Robust Mixing for Structured Overlay Networks

1. Robust Mixing for Structured Overlay Networks Christian Scheideler Institut für Informatik Technische Universität München

2. Motivation • Peer-to-peer systems have attracted a lot of attention in recent years • Many scientific peer-to-peer systems use overlay networks based on virtual space

3. Motivation • V: set of peers, U: virtual space • Each v 2 V mapped to regionR(v) ½ U • Family F of functionsf:U ! U • {v,w} edge ,[F(R(v)) Å R(w)] [ [F(R(w)) Å R(v)] = ;

4. 0 1 f0 f1 R 0 1 Example • Let U=[0,1). • Region selection: [Karger et al. 97]- nodes v 2 V! random points xv2 U- R(v) = [xv, succ(xv)) (regions form partition of U) • Family F of functions: [Naor & Wieder 03]- f0: x ! x/2- f1: x ! (x+1)/2

5. Scalability and Robustness Scalability: • Network has (poly-)logarithmic diameter • Peers have (poly-)logarithmic degree Robustness: • Network can handle large fraction of adversarial peers (i.e. honest peers form single connected component)! join-leave attacks

6. Join-Leave Model • nhonest peers • nadversarial peers, <1 Operations: • Join(v): peer v joins the system • Leave(v): peer v leaves the system Goal:maintain scalability and robustness for any sequence of polynomially many adversarial rejoin (leave+join) requests

7. More specific goal • n honest peers, n adversarial peers • U=[0,1), region selection via Karger et al.( R(v) = [xv, succ(xv)) ) For any interval I ½ [0,1) of size (c log n)/n: • Balancing condition:(log n) peers in I • Majority condition: honest peers in majority

8. How to satisfy conditions? Chord:uses cryptographic hash function to map peers to points in [0,1) • randomly distributes honest peers • does not randomly distribute adversarial peers

9. How to satisfy conditions? CAN: map peers to random points in [0,1)

10. How to satisfy conditions? Group spreading[AS04]: • Map peers to random points in [0,1) • Limit lifetime of peers Too expensive!

11. How to satisfy conditions? • Rule that works:k-cuckoo rule n honest n adversarial evict k/n-region < 1-1/k Rejoin: leave and join via k-cuckoo rule

12. Analysis of k-cuckoo rule • k-region: region of sizek/n starting at integer multiple of k/n • R:fixed set of c log nconsec.k-regions • New node:not yet replaced after joining • >0:small constant Lemma:R has at most c log n new nodes. Lemma: Sum of ages of k-regions in R in (1 §) (c log n)n/k, w.h.p.

13. Analyis of k-cuckoo rule • R:fixed set of c log nconsecutivek-regions • T=(/)log3 n • >0:small constant Lemma: In any time interval of size T,(1§)kT honest nodes and (1§)kT adv. nodes evicted, w.h.p. Lemma:R has (1§)(c log n)k old honest and <(1+)(c log n)k old adv. nodes, w.h.p.

14. Analysis of k-cuckoo rule # honest nodes in R: >(1-)(c log n)k # adversarial nodes in R:<(1+)(c log n)k + (c log n) Theorem: When using the k-cuckoo rule with <1-1/k, the balancing and majority conditions are satisfied for poly many adversarial rejoin requests, w.h.p.

15. Limitation of k-cuckoo rule • Only works for any sequence of rejoin requests of adversarial peers. • Does not work for any sequence of rejoin requests. Example: adversary orders all peers in a region of size O(log n / n) to leave

16. k-flip&evict rule • Join: as before (k-cuckoo rule) • Leave: choose randomk-region among c log nneighboringk-regions, flip it with random k region n honest n adversarial flip

17. k-region O(log n)-region k-flip&evict rule Leave: why flip neighboringk-region??? • Anyk-region: O(log n)-region may lose too many peers

18. k-flip&evict rule Leave: why flip neighboringk-region??? • k-region of leaving peer: k-regions in O(log n)-region may become too young • Age distribution: • O(log n) attempts to replace k-region with k-region of age O(n/log n) # O(log n)-regions age

19. k-flip&evict rule Leave: why flip neighboringk-region??? • Focus on region R of c log nk-regions • At most c log nnew nodes in R • <(1+)c log n nodes left k-regions before they joined R, w.h.p. • <(1+)c log n nodes left k-regions after they joined R, w.h.p. • Total age of k-regions > (1-)(c log n)(n/k)

20. Analysis of k-flip&evict rule # honest nodes in R: >(1-)(c log n)k – (1+)(c log n)2 # adversarial nodes in R:<(1+)(c log n)k + (c log n) Theorem: When using the k-flip&evict rule with <1-3/k, the balancing and majority conditions are satisfied for poly many rejoin requests, w.h.p.

21. Conclusion • Light-weight perturbation rules against join-leave attacks possible • Recent paper at SPAA 06 • Problems in real world:DoS-attacks, random number generation • RNG: to appear at OPODIS 06 • DoS: ???

22. Questions?